California lawmakers unanimously pass Linux exemption from age-verification law
California Legislators Unanimously Approve Linux Exemption for Age-Verification Mandates
Open-source software distributed via licenses such as Apache, BSD, MIT, and GPL is now officially exempt from new state regulations.
Summary: In a decisive move, California has amended its upcoming Digital Age Assurance Act via Assembly Bill 1856, ensuring that open-source operating systems are not burdened by mandatory age-verification data collection.
📅 Legislative Timeline & Status
The path to this exemption involved a swift series of legislative actions to clear up ambiguity before the law's deadline.
- August 21: Senate amends the Bill.
- August 26: Senate passes the Bill with a unanimous vote.
- August 27: Assembly concurs with the Senate's changes.
- Final Step: Awaiting final signature from Governor Gavin Newsom (who signed the original act last October).
Effective Date: January 1, 2027.
🛠️ Who is Exempt?
The amendment fundamentally alters the definition of an "operating system provider." Now, any entity that provides an OS or application under terms that allow the user to modify, redistribute, and copy the software is excluded.
Qualifying Licenses
The following licenses satisfy the legal test for exemption:
GPL(General Public License)MITBSDApache
Impacted Distributions
Because of these license terms, the following are no longer within the scope of AB 1856:
- Linux Distros: Ubuntu, Fedora, Debian, Arch, and SteamOS.
- BSD Family: Various BSD-based operating systems.
| Entity Type | Status under AB 1856 | Requirement |
|---|---|---|
| Proprietary OS (Windows, macOS, iOS, Android) | Covered | Must collect/provide age signals |
| Open Source OS (Linux, BSD) | Exempt | No age data collection required |
🔍 Technical Nuances & Carve-outs
The legislation includes specific technical distinctions to prevent "scope creep" into the open-source ecosystem.
1. Package Managers vs. App Stores
The law now excludes software components that are not standalone executable applications provided through a "covered application store." This protects:
- Libraries and dependencies.
- Software distributed via package managers like
aptorpacman.
2. Host-Application Extensions
A third exclusion was added for storefronts that only distribute add-ons or extensions designed to run inside a host application (e.g., browser extension stores).
3. The "Age Signal" Logic
The law's framework relies on a specific data flow:
OS Provider Age Signal App Store Developer
Since an exempt open-source OS does not generate this signal, the chain is broken for those platforms.
⚠️ Correcting Critical Errors
The amendments also fixed a glaring definition error in the original text. Previously, the law defined a "user" as:
"a child that is the primary user of a device"
Nuance: Under that original phrasing, logically, every single device owner in California was classified as a child, making it impossible for anyone to be flagged as an adult in the system. This has now been removed.
🛡️ Privacy and Legal Protections
To prevent the "Age API" from becoming a tool for general surveillance, lawmakers added two key safeguards:
- Anti-Abuse Provision: It is now illegal to request an age signal from an app store or OS provider unless it is explicitly required by law.
- Safe Harbor: Developers and platforms are granted a good-faith safe harbor, meaning they cannot be held liable for acting on an erroneous age signal provided to them.
🖼️ Related Visuals
(Additional assets: Image 1, Image 2, Image 3, Image 4, Image 5, Image 6, Image 7)
